Surge

New Features

- Added the [IP Rewrite] section to process packets entering Surge VIF by destination address before rule matching. Supported actions include reflect, reject, and drop. This can provide on-device loopback functionality for certain iOS developer toolchains.
- Added a category parameter to policy groups for grouped display.
- All test-url parameters now support HTTPS URLs. Results still measure a single HTTP round-trip latency, although TLS handshakes may increase overall testing time.
- Added a device communication takeover option for Include All mode.
- Added external resource management and other helper endpoints to the HTTP API.
- URL-based linked profiles can now be updated manually.

UI and Rules

- Updated UI layouts and details for iPhone Duo support.
- Improved the Add Rule page: domain rules can now be created from SNI-sniffed requests, and rule-specific options can be selected directly.
- Inline rulesets with the same name now merge across the main profile and modules, preserving rules from each source.
- Fixed logical rules incorrectly parsing policy names containing parentheses.

Networking and Reliability

- Improved Tailscale and WireGuard behavior when switching networks.
- Improved UDP test diagnostics for peer-to-peer Tailscale and WireGuard policies without Internet egress, reporting unsupported tests instead of waiting for a timeout.
- Removed an erroneous Ponte notification when using a Ponte policy in a policy group.
- Reverted per-domain MITM key-pair generation to address noticeable delays when intercepting many different domains concurrently.
- Fixed a scripting-engine compatibility issue.
- Improved performance and memory usage, fixed rare crashes, and resolved other minor issues.